Coinbase Cartel, the ransomware group that listed a US medical billing firm last week, has added an Indonesian traditional herbal medicine manufacturer to its leak site. Threat trackers logged the claim August 22.
PT Perusahaan Jamu Air Mancur, based in Solo, Central Java, manufactures and distributes jamu, the traditional Indonesian herbal remedies sold widely across the country’s health product market. The claim remains unconfirmed: ransomware.live and RansomLook both flag it as alleged, and no proof-of-data has been published.
The same batch of listings from the group included an insurance firm, a transportation company, and other non-healthcare targets. Coinbase Cartel also posted Integrated Health Systems, a US medical billing firm, the same day.
Consumer health product makers are increasingly appearing on leak sites alongside hospitals and drugmakers. Herbal medicine companies hold customer, supplier, and logistics data that extortion groups can weaponize in ransom negotiations even without clinical records.
Neither the company nor the group has commented publicly. MedRisk treats tracker listings as unconfirmed claims until the victim organization or independent analysis verifies data theft.
